JVN#76298784    
Multiple vulnerabilities in Security Point (Windows) of MaLion

Security Point (Windows) of MaLion provided by Intercom, Inc. contains multiple vulnerabilities.

CVE-2025-59485

• Security Point (Windows) of MaLion prior to Ver.5.3.4

CVE-2025-62691, CVE-2025-64693

• Security Point (Windows) of MaLion prior to Ver.7.1.1.9
• Security Point (Windows) of MaLionCloud prior to Ver.7.2.0.1

Security Point (Windows) of MaLion provided by Intercom, Inc. contains multiple vulnerabilities listed below.

• Incorrect default permissions (CWE-276)
  • CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N Base Score 4.8
  • CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Base Score 3.3
  • CVE-2025-59485
• Stack-based buffer overflow in processing HTTP headers (CWE-121)
  • CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Base Score 9.3
  • CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Base Score 9.8
  • CVE-2025-62691
• Heap-based buffer overflow in processing Content-Length (CWE-122)
  • CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Base Score 9.3
  • CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Base Score 9.8
  • CVE-2025-64693

• An arbitrary file could be placed in the specific folder by a user who can log in to the system where the product's Windows client is installed. If the file is a specially crafted DLL file, arbitrary code could be executed with SYSTEM privilege (CVE-2025-59485)
• Receiving a specially crafted request from a remote unauthenticated attacker could lead to arbitrary code execution with SYSTEM privilege (CVE-2025-62691, CVE-2025-64693)

Update the product
Update the product to the latest version according to the information provided by the developer.
The developer has released the following updates that contain fixes for these vulnerabilities.

CVE-2025-59485

• Security Point (Windows) of MaLion Ver.5.3.4 or later

CVE-2025-62691, CVE-2025-64693

• Security Point (Windows) of MaLion Ver.7.1.1.9 or later
• Security Point (Windows) of MaLionCloud Ver.7.2.0.1 or later

Vendor	Link
Intercom, Inc.	About vulnerabilities in MaLion Security Point (Windows) (Text in Japanese)

CVE-2025-59485
Ruslan Sayfiev of GMO Cybersecurity by Ierae, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

CVE-2025-62691, CVE-2025-64693
Denis Faiustov, and Ruslan Sayfiev of GMO Cybersecurity by Ierae, Inc. reported these vulnerabilities to JPCERT/CC.
JPCERT/CC coordinated with the developer.